From 0d677c3bd32e2fe47c4a600f1febe3048feb12e0 Mon Sep 17 00:00:00 2001 From: Naga Nandyala Date: Thu, 14 May 2026 14:32:45 +1000 Subject: [PATCH 1/5] [Auth] Enable broker-based authentication on macOS (opt-in) - Add enable_broker_on_mac config (default: False, opt-in via core.enable_broker_on_mac=true) - Pass enable_broker_on_mac to MSAL Identity and PublicClientApplication - Add EnableBrokerOnMac telemetry property - Install msal[broker] on darwin in addition to win32 - Add requirements.py3.MacOS.txt with msal[broker] and pymsalruntime pinned - Update build script to use MacOS requirements file - Add unit tests for broker_on_mac default and opt-in behavior Supersedes #32773 --- scripts/release/macos/build_binary_tar_gz.py | 4 +- src/azure-cli-core/azure/cli/core/_profile.py | 5 +- .../azure/cli/core/auth/identity.py | 6 +- .../azure/cli/core/telemetry.py | 7 +- .../azure/cli/core/tests/test_profile.py | 24 ++- src/azure-cli-core/setup.py | 4 +- src/azure-cli/requirements.py3.MacOS.txt | 140 ++++++++++++++++++ 7 files changed, 180 insertions(+), 10 deletions(-) create mode 100644 src/azure-cli/requirements.py3.MacOS.txt diff --git a/scripts/release/macos/build_binary_tar_gz.py b/scripts/release/macos/build_binary_tar_gz.py index 0215d254217..200a4b095cf 100644 --- a/scripts/release/macos/build_binary_tar_gz.py +++ b/scripts/release/macos/build_binary_tar_gz.py @@ -72,7 +72,7 @@ PROJECT_ROOT = Path(__file__).resolve().parents[3] SRC_DIR = PROJECT_ROOT / "src" AZURE_CLI_CORE_DIR = SRC_DIR / "azure-cli-core" -REQUIREMENTS_FILE = SRC_DIR / "azure-cli" / "requirements.py3.Darwin.txt" +REQUIREMENTS_FILE = SRC_DIR / "azure-cli" / "requirements.py3.MacOS.txt" # Package configuration APP_NAME = "azure-cli" @@ -187,7 +187,7 @@ def install_azure_cli(venv_python: Path) -> None: Mirrors the run.sh approach: 1. Install all src packages with --no-deps (local source code takes precedence) - 2. Install pinned dependencies from requirements.py3.Darwin.txt + 2. Install pinned dependencies from requirements.py3.MacOS.txt """ # Step 1: install every package found under SRC_DIR from source, without pulling # transitive deps from PyPI (--no-deps). This ensures the locally-built wheels diff --git a/src/azure-cli-core/azure/cli/core/_profile.py b/src/azure-cli-core/azure/cli/core/_profile.py index de0c8efe70f..ab68157f4a8 100644 --- a/src/azure-cli-core/azure/cli/core/_profile.py +++ b/src/azure-cli-core/azure/cli/core/_profile.py @@ -970,8 +970,10 @@ def _create_identity_instance(cli_ctx, authority, tenant_id=None, client_id=None # On Windows, use core.enable_broker_on_windows=false to disable broker (WAM) for authentication. enable_broker_on_windows = cli_ctx.config.getboolean('core', 'enable_broker_on_windows', fallback=True) + # On macOS, broker authentication is opt-in. Use core.enable_broker_on_mac=true to enable it. + enable_broker_on_mac = cli_ctx.config.getboolean('core', 'enable_broker_on_mac', fallback=False) from .telemetry import set_broker_info - set_broker_info(enable_broker_on_windows) + set_broker_info(enable_broker_on_windows, enable_broker_on_mac) # PREVIEW: In Azure Stack environment, use core.instance_discovery=false to disable MSAL's instance discovery. instance_discovery = cli_ctx.config.getboolean('core', 'instance_discovery', True) @@ -980,4 +982,5 @@ def _create_identity_instance(cli_ctx, authority, tenant_id=None, client_id=None encrypt=encrypt, use_msal_http_cache=use_msal_http_cache, enable_broker_on_windows=enable_broker_on_windows, + enable_broker_on_mac=enable_broker_on_mac, instance_discovery=instance_discovery) diff --git a/src/azure-cli-core/azure/cli/core/auth/identity.py b/src/azure-cli-core/azure/cli/core/auth/identity.py index 91629e89441..b2c04043277 100644 --- a/src/azure-cli-core/azure/cli/core/auth/identity.py +++ b/src/azure-cli-core/azure/cli/core/auth/identity.py @@ -58,7 +58,7 @@ class Identity: # pylint: disable=too-many-instance-attributes _service_principal_store_instance = None def __init__(self, authority, tenant_id=None, client_id=None, encrypt=False, use_msal_http_cache=True, - enable_broker_on_windows=None, instance_discovery=None): + enable_broker_on_windows=None, enable_broker_on_mac=None, instance_discovery=None): """ :param authority: Authentication authority endpoint. For example, - AAD: https://login.microsoftonline.com @@ -74,6 +74,7 @@ def __init__(self, authority, tenant_id=None, client_id=None, encrypt=False, use self._encrypt = encrypt self._use_msal_http_cache = use_msal_http_cache self._enable_broker_on_windows = enable_broker_on_windows + self._enable_broker_on_mac = enable_broker_on_mac self._instance_discovery = instance_discovery # Build the authority in MSAL style @@ -111,9 +112,10 @@ def _msal_app_kwargs(self): @property def _msal_public_app_kwargs(self): """kwargs for creating PublicClientApplication.""" - # enable_broker_on_windows can only be used on PublicClientApplication. + # enable_broker_on_windows and enable_broker_on_mac can only be used on PublicClientApplication. return {**self._msal_app_kwargs, "enable_broker_on_windows": self._enable_broker_on_windows, + "enable_broker_on_mac": self._enable_broker_on_mac, "enable_pii_log": True} @property diff --git a/src/azure-cli-core/azure/cli/core/telemetry.py b/src/azure-cli-core/azure/cli/core/telemetry.py index aeb06ba35f2..9de515d7e7e 100644 --- a/src/azure-cli-core/azure/cli/core/telemetry.py +++ b/src/azure-cli-core/azure/cli/core/telemetry.py @@ -77,6 +77,7 @@ def __init__(self, correlation_id=None, application=None): self.user_agent = None # authentication-related self.enable_broker_on_windows = None + self.enable_broker_on_mac = None self.msal_telemetry = None self.login_experience_v2 = None @@ -237,6 +238,7 @@ def _get_azure_cli_properties(self): set_custom_properties(result, 'SecretNames', ','.join(self.secret_names or [])) # authentication-related set_custom_properties(result, 'EnableBrokerOnWindows', str(self.enable_broker_on_windows)) + set_custom_properties(result, 'EnableBrokerOnMac', str(self.enable_broker_on_mac)) set_custom_properties(result, 'MsalTelemetry', self.msal_telemetry) set_custom_properties(result, 'LoginExperienceV2', str(self.login_experience_v2)) @@ -483,9 +485,10 @@ def set_region_identified(region_input, region_identified): # region authentication-related @decorators.suppress_all_exceptions() -def set_broker_info(enable_broker_on_windows): - # Log the value of `enable_broker_on_windows` +def set_broker_info(enable_broker_on_windows, enable_broker_on_mac=None): + # Log the value of `enable_broker_on_windows` and `enable_broker_on_mac` _session.enable_broker_on_windows = enable_broker_on_windows + _session.enable_broker_on_mac = enable_broker_on_mac @decorators.suppress_all_exceptions() diff --git a/src/azure-cli-core/azure/cli/core/tests/test_profile.py b/src/azure-cli-core/azure/cli/core/tests/test_profile.py index bef9b67a39c..e6effc818d2 100644 --- a/src/azure-cli-core/azure/cli/core/tests/test_profile.py +++ b/src/azure-cli-core/azure/cli/core/tests/test_profile.py @@ -11,7 +11,7 @@ from copy import deepcopy from unittest import mock -from azure.cli.core._profile import (Profile, SubscriptionFinder, _attach_token_tenant, +from azure.cli.core._profile import (Profile, SubscriptionFinder, _attach_token_tenant, _create_identity_instance, _transform_subscription_for_multiapi, _TENANT_LEVEL_ACCOUNT_NAME) from azure.cli.core.auth.util import AccessToken @@ -1396,6 +1396,28 @@ def test_logout_all(self, logout_all_users_mock, logout_all_service_principal_mo logout_all_users_mock.assert_called_once() logout_all_service_principal_mock.assert_called_once() + @mock.patch('azure.cli.core.auth.identity.Identity', autospec=True) + def test_create_identity_instance_broker_on_mac_default_opt_in(self, identity_mock): + # Verify that broker on macOS is opt-in: default is False unless user sets + # core.enable_broker_on_mac=true. See CLIPS#55. + cli = DummyCli() + _create_identity_instance(cli, authority='https://login.microsoftonline.com') + _, kwargs = identity_mock.call_args + self.assertEqual(kwargs['enable_broker_on_mac'], False) + # Windows broker remains opt-out (default True). + self.assertEqual(kwargs['enable_broker_on_windows'], True) + + @mock.patch('azure.cli.core.auth.identity.Identity', autospec=True) + def test_create_identity_instance_broker_on_mac_opt_in_enabled(self, identity_mock): + cli = DummyCli() + cli.config.set_value('core', 'enable_broker_on_mac', 'true') + try: + _create_identity_instance(cli, authority='https://login.microsoftonline.com') + finally: + cli.config.remove_option('core', 'enable_broker_on_mac') + _, kwargs = identity_mock.call_args + self.assertEqual(kwargs['enable_broker_on_mac'], True) + @mock.patch('azure.cli.core._profile.SubscriptionFinder._create_subscription_client', autospec=True) @mock.patch('azure.cli.core.auth.identity.Identity.get_user_credential', autospec=True) def test_refresh_accounts_one_user_account(self, get_user_credential_mock, create_subscription_client_mock): diff --git a/src/azure-cli-core/setup.py b/src/azure-cli-core/setup.py index 2fb150f0aa9..a663bfa581c 100644 --- a/src/azure-cli-core/setup.py +++ b/src/azure-cli-core/setup.py @@ -55,8 +55,8 @@ 'knack~=0.11.0', 'microsoft-security-utilities-secret-masker~=1.0.0b4', 'msal-extensions==1.3.1', - 'msal[broker]==1.35.1; sys_platform == "win32"', - 'msal==1.35.1; sys_platform != "win32"', + 'msal[broker]==1.35.1; sys_platform == "win32" or sys_platform == "darwin"', + 'msal==1.35.1; sys_platform != "win32" and sys_platform != "darwin"', 'packaging>=20.9', 'pkginfo>=1.5.0.1', # psutil can't install on cygwin: https://github.com/Azure/azure-cli/issues/9399 diff --git a/src/azure-cli/requirements.py3.MacOS.txt b/src/azure-cli/requirements.py3.MacOS.txt new file mode 100644 index 00000000000..afec5ac5d52 --- /dev/null +++ b/src/azure-cli/requirements.py3.MacOS.txt @@ -0,0 +1,140 @@ +antlr4-python3-runtime==4.13.1 +applicationinsights==0.11.9 +argcomplete==3.5.2 +asn1crypto==0.24.0 +azure-appconfiguration==1.7.2 +azure-batch==15.0.0b1 +azure-cli-core==2.86.0 +azure-cli-telemetry==1.1.0 +azure-cli==2.86.0 +azure-common==1.1.22 +azure-core==1.39.0 +azure-cosmos==3.2.0 +azure-data-tables==12.4.0 +azure-datalake-store==1.0.1 +azure-keyvault-administration==4.4.0 +azure-keyvault-certificates==4.7.0 +azure-keyvault-keys==4.11.0 +azure-keyvault-secrets==4.7.0 +azure-keyvault-securitydomain==1.0.0b1 +azure-mgmt-advisor==9.0.0 +azure-mgmt-apimanagement==4.0.0 +azure-mgmt-appconfiguration==6.0.0b1 +azure-mgmt-appcontainers==2.0.0 +azure-mgmt-applicationinsights==1.0.0 +azure-mgmt-authorization==5.0.0b1 +azure-mgmt-batch==17.3.0 +azure-mgmt-batchai==7.0.0b1 +azure-mgmt-billing==6.0.0 +azure-mgmt-botservice==2.0.0b3 +azure-mgmt-cdn==12.0.0 +azure-mgmt-cognitiveservices==15.0.0b1 +azure-mgmt-compute==34.1.0 +azure-mgmt-containerinstance==10.2.0b1 +azure-mgmt-containerregistry==15.1.0b1 +azure-mgmt-containerregistrytasks==1.0.0b1 +azure-mgmt-containerservice==41.1.0 +azure-mgmt-core==1.6.0 +azure-mgmt-cosmosdb==9.9.0 +azure-mgmt-datalake-nspkg==3.0.1 +azure-mgmt-datalake-store==1.1.0b1 +azure-mgmt-datamigration==10.0.0 +azure-mgmt-eventgrid==10.2.0b2 +azure-mgmt-eventhub==12.0.0b1 +azure-mgmt-extendedlocation==1.0.0b2 +azure-mgmt-hdinsight==9.1.0b2 +azure-mgmt-imagebuilder==1.3.0 +azure-mgmt-iotcentral==10.0.0b1 +azure-mgmt-iothub==5.0.0b1 +azure-mgmt-iothubprovisioningservices==1.1.0 +azure-mgmt-keyvault==13.0.0 +azure-mgmt-loganalytics==13.0.0b4 +azure-mgmt-managementgroups==1.0.0 +azure-mgmt-maps==2.0.0 +azure-mgmt-marketplaceordering==1.1.0 +azure-mgmt-media==9.0.0 +azure-mgmt-monitor==7.0.0b1 +azure-mgmt-msi==7.1.0 +azure-mgmt-netapp==10.1.0 +azure-mgmt-policyinsights==1.1.0b4 +azure-mgmt-postgresqlflexibleservers==3.0.0b1 +azure-mgmt-privatedns==1.0.0 +azure-mgmt-rdbms==10.2.0b17 +azure-mgmt-mysqlflexibleservers==1.1.0b2 +azure-mgmt-recoveryservices==4.0.0 +azure-mgmt-recoveryservicesbackup==9.2.0 +azure-mgmt-redhatopenshift~=3.0.0 +azure-mgmt-redis==14.5.0 +azure-mgmt-resource==24.0.0 +azure-mgmt-resource-deployments==1.0.0b1 +azure-mgmt-resource-deploymentscripts==1.0.0b1 +azure-mgmt-resource-deploymentstacks==1.0.0 +azure-mgmt-resource-templatespecs==1.0.0b1 +azure-mgmt-search==9.0.0 +azure-mgmt-security==6.0.0 +azure-mgmt-servicebus==10.0.0b1 +azure-mgmt-servicefabric==2.1.0 +azure-mgmt-servicefabricmanagedclusters==2.1.0b1 +azure-mgmt-servicelinker==1.2.0b3 +azure-mgmt-sql==4.0.0b22 +azure-mgmt-signalr==2.0.0b2 +azure-mgmt-sqlvirtualmachine==1.0.0b5 +azure-mgmt-storage==24.0.0 +azure-mgmt-synapse==2.1.0b5 +azure-mgmt-trafficmanager==1.0.0 +azure-mgmt-web==9.0.0 +azure-monitor-query==1.2.0 +azure-nspkg==3.0.2 +azure-storage-common==1.4.2 +azure-storage-blob==12.29.0b1 +azure-storage-file-datalake==12.24.0b1 +azure-storage-file-share==12.25.0b1 +azure-storage-queue==12.16.0b1 +azure-synapse-accesscontrol==0.5.0 +azure-synapse-artifacts==0.22.0 +azure-synapse-managedprivateendpoints==0.4.0 +azure-synapse-spark==0.7.0 +bcrypt==3.2.0 +certifi==2024.7.4 +cffi==2.0.0 +chardet==5.2.0 +colorama==0.4.6 +cryptography==46.0.7 +fabric==3.2.2 +humanfriendly==10.0 +idna==3.7 +invoke==2.2.0 +isodate==0.6.1 +javaproperties==0.5.1 +jmespath==0.9.5 +jsondiff==2.0.0 +knack==0.11.0 +msal-extensions==1.3.1 +msal[broker]==1.35.1 +msrest==0.7.1 +oauthlib==3.2.2 +packaging==25.0 +paramiko==3.5.0 +pbr==7.0.3 +pkginfo==1.8.2 +portalocker==3.2.0 +psutil==6.1.0 +pycomposefile==0.0.34 +PyGithub==1.55 +PyJWT==2.12.0 +pymsalruntime==0.20.5 +PyNaCl==1.6.2 +pyOpenSSL==26.0.0 +PySocks==1.7.1 +python-dateutil==2.8.0 +requests-oauthlib==1.2.0 +requests==2.33.0 +scp==0.13.2 +semver==3.0.4 +six==1.16.0 +sshtunnel==0.1.5 +tabulate==0.8.9 +urllib3==2.7.0 +wcwidth==0.1.7 +websocket-client==1.8.0 +xmltodict==0.12.0 From ed12ec28e8d08489e71dd1626d5149840d158433 Mon Sep 17 00:00:00 2001 From: Naga Nandyala Date: Tue, 8 Sep 2026 11:16:16 +1000 Subject: [PATCH 2/5] Restore setup.py quote style --- src/azure-cli-core/setup.py | 76 ++++++++++++++++++------------------- 1 file changed, 38 insertions(+), 38 deletions(-) diff --git a/src/azure-cli-core/setup.py b/src/azure-cli-core/setup.py index 7ce4ad52092..6f3e4936d37 100644 --- a/src/azure-cli-core/setup.py +++ b/src/azure-cli-core/setup.py @@ -13,7 +13,7 @@ # If we have source, validate that our version numbers match # This should prevent uploading releases with mismatched versions. try: - with open("azure/cli/core/__init__.py", "r", encoding="utf-8") as f: + with open('azure/cli/core/__init__.py', 'r', encoding='utf-8') as f: content = f.read() except OSError: pass @@ -23,70 +23,70 @@ m = re.search(r'__version__\s*=\s*[\'"](.+?)[\'"]', content) if not m: - print("Could not find __version__ in azure/cli/core/__init__.py") + print('Could not find __version__ in azure/cli/core/__init__.py') sys.exit(1) if m.group(1) != VERSION: print('Expected __version__ = "{}"; found "{}"'.format(VERSION, m.group(1))) sys.exit(1) CLASSIFIERS = [ - "Development Status :: 5 - Production/Stable", - "Intended Audience :: Developers", - "Intended Audience :: System Administrators", - "Programming Language :: Python", - "Programming Language :: Python :: 3", - "Programming Language :: Python :: 3.10", - "Programming Language :: Python :: 3.11", - "Programming Language :: Python :: 3.12", - "Programming Language :: Python :: 3.13", - "Programming Language :: Python :: 3.14", - "License :: OSI Approved :: MIT License", + 'Development Status :: 5 - Production/Stable', + 'Intended Audience :: Developers', + 'Intended Audience :: System Administrators', + 'Programming Language :: Python', + 'Programming Language :: Python :: 3', + 'Programming Language :: Python :: 3.10', + 'Programming Language :: Python :: 3.11', + 'Programming Language :: Python :: 3.12', + 'Programming Language :: Python :: 3.13', + 'Programming Language :: Python :: 3.14', + 'License :: OSI Approved :: MIT License', ] DEPENDENCIES = [ - "argcomplete~=3.5.2", - "azure-cli-telemetry==1.1.0.*", - "azure-core~=1.39.0", - "azure-mgmt-core>=1.2.0,<2", - "cryptography", + 'argcomplete~=3.5.2', + 'azure-cli-telemetry==1.1.0.*', + 'azure-core~=1.39.0', + 'azure-mgmt-core>=1.2.0,<2', + 'cryptography', # On Linux, the distribution (Ubuntu, Debian, etc) and version are logged in telemetry 'distro; sys_platform == "linux"', - "humanfriendly~=10.0", - "jmespath", - "knack~=0.14.0", - "microsoft-security-utilities-secret-masker~=1.0.0b4", - "msal-extensions==1.3.1", + 'humanfriendly~=10.0', + 'jmespath', + 'knack~=0.14.0', + 'microsoft-security-utilities-secret-masker~=1.0.0b4', + 'msal-extensions==1.3.1', 'msal[broker]==1.36.0; sys_platform == "win32" or sys_platform == "darwin"', 'msal==1.36.0; sys_platform != "win32" and sys_platform != "darwin"', - "packaging>=20.9", + 'packaging>=20.9', # pkginfo>=1.12.0 reads the spec-defined wheel METADATA / unpacked .dist-info # layout produced by modern wheel/setuptools (no metadata.json). Required so # WheelExtension.get_metadata works without the legacy wheel==0.30.0 artifact. - "pkginfo>=1.12.0", + 'pkginfo>=1.12.0', # psutil can't install on cygwin: https://github.com/Azure/azure-cli/issues/9399 'psutil>=5.9; sys_platform != "cygwin"', - "PyJWT>=2.1.0", - "pyopenssl>=17.1.0", # https://github.com/pyca/pyopenssl/pull/612 - "py-deviceid", - "requests[socks]", + 'PyJWT>=2.1.0', + 'pyopenssl>=17.1.0', # https://github.com/pyca/pyopenssl/pull/612 + 'py-deviceid', + 'requests[socks]', ] -with open("README.rst", "r", encoding="utf-8") as f: +with open('README.rst', 'r', encoding='utf-8') as f: README = f.read() setup( - name="azure-cli-core", + name='azure-cli-core', version=VERSION, - description="Microsoft Azure Command-Line Tools Core Module", + description='Microsoft Azure Command-Line Tools Core Module', long_description=README, - license="MIT", - author="Microsoft Corporation", - author_email="azpycli@microsoft.com", - url="https://github.com/Azure/azure-cli", + license='MIT', + author='Microsoft Corporation', + author_email='azpycli@microsoft.com', + url='https://github.com/Azure/azure-cli', zip_safe=False, classifiers=CLASSIFIERS, packages=find_packages(exclude=["*.tests", "*.tests.*", "tests.*", "tests", "azure", "azure.cli"]), install_requires=DEPENDENCIES, - python_requires=">=3.10.0", - package_data={"azure.cli.core": ["auth/landing_pages/*.html", "commandIndex.latest.json", "helpIndex.latest.json"]}, + python_requires='>=3.10.0', + package_data={'azure.cli.core': ['auth/landing_pages/*.html', 'commandIndex.latest.json', 'helpIndex.latest.json']} ) From 14d068542bdb66b9e55b3e946f8a69a4d92e8ad4 Mon Sep 17 00:00:00 2001 From: Naga Nandyala Date: Tue, 8 Sep 2026 11:54:34 +1000 Subject: [PATCH 3/5] Keep broker runtime out of Homebrew formula --- scripts/release/homebrew/docker/formula_generate.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/release/homebrew/docker/formula_generate.py b/scripts/release/homebrew/docker/formula_generate.py index b888921abf5..bbb8f320e86 100644 --- a/scripts/release/homebrew/docker/formula_generate.py +++ b/scripts/release/homebrew/docker/formula_generate.py @@ -99,7 +99,8 @@ def collect_resources_dict() -> dict: def resource_filter(name: str) -> bool: # TODO remove need for any filters and delete this method. - return not name.startswith('azure-cli') and name not in ('futures', 'jeepney', 'entrypoints') + # The standalone cask bundles the macOS broker runtime; the Homebrew Core formula uses plain MSAL. + return not name.startswith('azure-cli') and name not in ('futures', 'jeepney', 'entrypoints', 'pymsalruntime') def last_bottle_hash(): From 23be24eab4ca7e3df077aca46e2514651ba62bb9 Mon Sep 17 00:00:00 2001 From: Naga Nandyala Date: Tue, 8 Sep 2026 12:00:01 +1000 Subject: [PATCH 4/5] Separate Homebrew formula and cask dependencies --- scripts/release/homebrew/docker/formula_generate.py | 3 +-- scripts/release/standalone/build_binary_tar_gz.py | 2 +- src/azure-cli/requirements.py3.Darwin.Standalone.txt | 3 +++ src/azure-cli/requirements.py3.Darwin.txt | 3 +-- 4 files changed, 6 insertions(+), 5 deletions(-) create mode 100644 src/azure-cli/requirements.py3.Darwin.Standalone.txt diff --git a/scripts/release/homebrew/docker/formula_generate.py b/scripts/release/homebrew/docker/formula_generate.py index bbb8f320e86..b888921abf5 100644 --- a/scripts/release/homebrew/docker/formula_generate.py +++ b/scripts/release/homebrew/docker/formula_generate.py @@ -99,8 +99,7 @@ def collect_resources_dict() -> dict: def resource_filter(name: str) -> bool: # TODO remove need for any filters and delete this method. - # The standalone cask bundles the macOS broker runtime; the Homebrew Core formula uses plain MSAL. - return not name.startswith('azure-cli') and name not in ('futures', 'jeepney', 'entrypoints', 'pymsalruntime') + return not name.startswith('azure-cli') and name not in ('futures', 'jeepney', 'entrypoints') def last_bottle_hash(): diff --git a/scripts/release/standalone/build_binary_tar_gz.py b/scripts/release/standalone/build_binary_tar_gz.py index 1007351c4e5..02508df7300 100644 --- a/scripts/release/standalone/build_binary_tar_gz.py +++ b/scripts/release/standalone/build_binary_tar_gz.py @@ -76,7 +76,7 @@ AZURE_CLI_CORE_DIR = SRC_DIR / "azure-cli-core" REQUIREMENTS_FILES = { "linux": SRC_DIR / "azure-cli" / "requirements.py3.Linux.txt", - "macos": SRC_DIR / "azure-cli" / "requirements.py3.Darwin.txt", + "macos": SRC_DIR / "azure-cli" / "requirements.py3.Darwin.Standalone.txt", } # Package configuration diff --git a/src/azure-cli/requirements.py3.Darwin.Standalone.txt b/src/azure-cli/requirements.py3.Darwin.Standalone.txt new file mode 100644 index 00000000000..772322b300e --- /dev/null +++ b/src/azure-cli/requirements.py3.Darwin.Standalone.txt @@ -0,0 +1,3 @@ +-r requirements.py3.Darwin.txt +msal[broker]==1.36.0 +pymsalruntime==0.20.6 \ No newline at end of file diff --git a/src/azure-cli/requirements.py3.Darwin.txt b/src/azure-cli/requirements.py3.Darwin.txt index 1ecfb231055..98d834ad7f5 100644 --- a/src/azure-cli/requirements.py3.Darwin.txt +++ b/src/azure-cli/requirements.py3.Darwin.txt @@ -111,7 +111,7 @@ jmespath==0.9.5 jsondiff==2.0.0 knack==0.14.0 msal-extensions==1.3.1 -msal[broker]==1.36.0 +msal==1.36.0 msrest==0.7.1 oauthlib==3.2.2 packaging==25.0 @@ -123,7 +123,6 @@ psutil==6.1.0 pycomposefile==0.0.34 PyGithub==1.55 PyJWT==2.13.0 -pymsalruntime==0.20.6 PyNaCl==1.6.2 pyOpenSSL==26.2.0 PySocks==1.7.1 From 9f51f1b6100cadb7fef0d81c5ac76260c01731cb Mon Sep 17 00:00:00 2001 From: Naga Nandyala Date: Tue, 8 Sep 2026 12:06:45 +1000 Subject: [PATCH 5/5] Rename macOS broker requirements overlay --- scripts/release/standalone/build_binary_tar_gz.py | 2 +- ...Darwin.Standalone.txt => requirements.py3.Darwin.Broker.txt} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename src/azure-cli/{requirements.py3.Darwin.Standalone.txt => requirements.py3.Darwin.Broker.txt} (100%) diff --git a/scripts/release/standalone/build_binary_tar_gz.py b/scripts/release/standalone/build_binary_tar_gz.py index 02508df7300..cc38a55f5e3 100644 --- a/scripts/release/standalone/build_binary_tar_gz.py +++ b/scripts/release/standalone/build_binary_tar_gz.py @@ -76,7 +76,7 @@ AZURE_CLI_CORE_DIR = SRC_DIR / "azure-cli-core" REQUIREMENTS_FILES = { "linux": SRC_DIR / "azure-cli" / "requirements.py3.Linux.txt", - "macos": SRC_DIR / "azure-cli" / "requirements.py3.Darwin.Standalone.txt", + "macos": SRC_DIR / "azure-cli" / "requirements.py3.Darwin.Broker.txt", } # Package configuration diff --git a/src/azure-cli/requirements.py3.Darwin.Standalone.txt b/src/azure-cli/requirements.py3.Darwin.Broker.txt similarity index 100% rename from src/azure-cli/requirements.py3.Darwin.Standalone.txt rename to src/azure-cli/requirements.py3.Darwin.Broker.txt